Transfer impact assessment
An assessment, before personal data is sent outside the EU under a transfer tool such as standard contractual clauses, of whether the destination country's law and practice let the importer honour it.
The Court of Justice required this case-by-case check in Schrems II, and the European Data Protection Board set out a roadmap for it in its Recommendations 01/2020: from knowing your transfers and identifying the transfer tool, to assessing the destination country’s law and practice, adopting supplementary measures where needed and re-evaluating at appropriate intervals.
A new subprocessor in a new country is the moment a transfer impact assessment may need to be done or updated.
Source: EDPB Recommendations 01/2020 ↗
Related terms
ClauseTrail watches vendors' subprocessor lists, DPAs, privacy policies, terms and AI terms, and tells your team what changed and by when to object.